# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1194 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1195 --- ## [First occurrence field value using ingest processor](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 3:37pm UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755 "2020-10-14T15:37:54Z")
Hello is there a way to tag a document with "first occurrence of a field" using an ingest processor? for example first occurrence of traffic from Japan (country:Japan) thanks --- ## [How to work on object to get 0,1,2,3 out of it](https://discuss.elastic.co/t/how-to-work-on-object-to-get-0-1-2-3-out-of-it/252040)
**Author:** [@amaleswar](https://discuss.elastic.co/u/amaleswar)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 3:30pm UTC](https://discuss.elastic.co/t/how-to-work-on-object-to-get-0-1-2-3-out-of-it/252040 "2020-10-14T15:30:44Z")
"eventInfo": { "delete.user.0.firstname": "david", "delete.user.0.lastname": "flank", "delete.user.0.city": "austin", "delete.user.1.firstname": "martin", "delete.user.1.lastname": "king", "delete.user.1.city": "da… --- ## [How to change two fields in an index to a geo point?](https://discuss.elastic.co/t/how-to-change-two-fields-in-an-index-to-a-geo-point/252033)
**Author:** [@witcher](https://discuss.elastic.co/u/witcher)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 3:19pm UTC](https://discuss.elastic.co/t/how-to-change-two-fields-in-an-index-to-a-geo-point/252033 "2020-10-14T15:19:47Z")
PUT \_ingest/pipeline/geoip { "description" : "Add geoip info", "processors" : \[ { "geoip" : { "field" : "source\_ip", "database\_file": "GeoLite2-City.mmdb", "target\_field": "sourceip\_geo" } } \] } … --- ## [Logstash - configuration with multiple sources](https://discuss.elastic.co/t/logstash-configuration-with-multiple-sources/252017)
**Author:** [@maria\_lopez\_perez](https://discuss.elastic.co/u/maria_lopez_perez)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 3:18pm UTC](https://discuss.elastic.co/t/logstash-configuration-with-multiple-sources/252017 "2020-10-14T15:18:32Z")
Hello, I try to create a configuration in Logstash in order to have two index in elasticserach relation to two diferentes sources (two files), The configuration is: input { file { path =\> "/etc/logstash/ficheros/disc… --- ## [Elasticserach 7.2 Unable to create cluster with error "Unable to lock JVM Memory: error=12, reason=Cannot allocate memory"](https://discuss.elastic.co/t/elasticserach-7-2-unable-to-create-cluster-with-error-unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/252050)
**Author:** [@bognad](https://discuss.elastic.co/u/bognad)\ **Replies:** 6\ **Last updated:** [October 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/elasticserach-7-2-unable-to-create-cluster-with-error-unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/252050 "2020-10-14T14:58:36Z")
Hello! Standalone (single-node) Elasticsearch is work fine. I tried creating one node cluster, but it results into error: elasticsearch\_1 | {"type": "server", "timestamp": "2020-10-14T11:38:41,989+0000", "level": "WA… --- ## [Logstash dash "-" (hyphen) problem with aggregation](https://discuss.elastic.co/t/logstash-dash-hyphen-problem-with-aggregation/251947)
**Author:** [@bnmtl](https://discuss.elastic.co/u/bnmtl)\ **Replies:** 8\ **Last updated:** [October 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/logstash-dash-hyphen-problem-with-aggregation/251947 "2020-10-14T14:39:44Z")
Hello, With my logstash configuration, I am reading JSON log, but in my JSON log I have fields like below; "host-name":"comp-1.example.com", "name-surname":"john-doe" My configuration in logstash; input { file {… --- ## [Count of true values in Kibana data table](https://discuss.elastic.co/t/count-of-true-values-in-kibana-data-table/252052)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 1:46pm UTC](https://discuss.elastic.co/t/count-of-true-values-in-kibana-data-table/252052 "2020-10-14T13:46:42Z")
I'm doing a Kibana data table which looks like: Environment Field1 Field2 Field3 Field4 Dev Sum Sum Sum ??? QA Sum Sum Sum ??? Stage Sum Sum Sum ??? Prod Sum Sum Sum ??? Field1, Field2, and Field3 are n… --- ## [Можно ли размещать на одном физическом сервере два Elasticsearch в роли data?](https://discuss.elastic.co/t/elasticsearch-data/251916)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 9\ **Last updated:** [October 14, 2020, 2:21pm UTC](https://discuss.elastic.co/t/elasticsearch-data/251916 "2020-10-14T14:21:51Z")
Добрый день! Скажите, можно ли размещать на одном физическом сервере два Elasticsearch в роли data? Чем это чревато? Аллоцировав под heap и кэш память, не начнут ли они вытеснять друг-друга? И еще скажите, какой преде… --- ## [Observability Metrics drilldown to uptime not working](https://discuss.elastic.co/t/observability-metrics-drilldown-to-uptime-not-working/251690)
**Author:** [@searchtool](https://discuss.elastic.co/u/searchtool)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 2:08pm UTC](https://discuss.elastic.co/t/observability-metrics-drilldown-to-uptime-not-working/251690 "2020-10-14T14:08:44Z")
When you select a host in the observability-Metrics screen you can select the option "Host in uptime". Upon entering that screen the search query for the host is based on host.ip, shouldn't this also be resolved.ip sinc… --- ## [How to send selected field from Kibana to ActiveMQ/application?](https://discuss.elastic.co/t/how-to-send-selected-field-from-kibana-to-activemq-application/252003)
**Author:** [@venkata.kodapaka](https://discuss.elastic.co/u/venkata.kodapaka)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-to-send-selected-field-from-kibana-to-activemq-application/252003 "2020-10-14T13:32:49Z")
Hi Team, I have few visualizations in my Kibana dashboard where I could see different methods data in linegraph. Eg: 'read','write','readAndWrite' these are all the Java methods for which I've built the line graph with … --- ## [Kibana logs are not shown](https://discuss.elastic.co/t/kibana-logs-are-not-shown/252026)
**Author:** [@sachithmuhandiram](https://discuss.elastic.co/u/sachithmuhandiram)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 1:25pm UTC](https://discuss.elastic.co/t/kibana-logs-are-not-shown/252026 "2020-10-14T13:25:02Z")
I have installed ELK in my Ubuntu-18 server and configured Kubernetes cluster with filebeats. Few days ago, Kibana -\> Logs were showing logs. But now I can not see any log shown there. I had checked kibana and elastic … --- ## [Start day of week in Advanced settings](https://discuss.elastic.co/t/start-day-of-week-in-advanced-settings/251235)
**Author:** [@amp](https://discuss.elastic.co/u/amp)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/start-day-of-week-in-advanced-settings/251235 "2020-10-14T12:50:52Z")
Hi, We are using ELK 7.8 basic version for log management and ITSM reports. Need to show the start day of week in reports as Tuesday and modified the start day as Tuesday in advanced settings in Kibana .But still the s… --- ## [Getting error while starting logstash - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAct ion::Create\, action\_result: false", :backtrace=\>nil](https://discuss.elastic.co/t/getting-error-while-starting-logstash-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineact-ion-create-main-action-result-false-backtrace-nil/252044)
**Author:** [@kanhaiyak424](https://discuss.elastic.co/u/kanhaiyak424)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 12:47pm UTC](https://discuss.elastic.co/t/getting-error-while-starting-logstash-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineact-ion-create-main-action-result-false-backtrace-nil/252044 "2020-10-14T12:47:48Z")
E:\\ELK\\Software\\logstash-7.9.1\\bin\>logstash -f logstash-simple-jms.conf Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. … --- ## [How to view custom plugin changes in Kibana 7.5](https://discuss.elastic.co/t/how-to-view-custom-plugin-changes-in-kibana-7-5/251483)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 12:41pm UTC](https://discuss.elastic.co/t/how-to-view-custom-plugin-changes-in-kibana-7-5/251483 "2020-10-14T12:41:51Z")
I written a few custom plugins for Kibana 7.5.0. I've found that if I install my updated plugin and then restart Kibana, I do not see my changes. If I want to see my changes to the pluign, I must uninstall my current plu… --- ## [Uptime not working in kibana 6.7.2 after heartbeat server update to 6.8.3](https://discuss.elastic.co/t/uptime-not-working-in-kibana-6-7-2-after-heartbeat-server-update-to-6-8-3/251914)
**Author:** [@suryanaj](https://discuss.elastic.co/u/suryanaj)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 12:28pm UTC](https://discuss.elastic.co/t/uptime-not-working-in-kibana-6-7-2-after-heartbeat-server-update-to-6-8-3/251914 "2020-10-14T12:28:02Z")
Hi Team, uptime (inside kibana dashboard) not working now after upgrade to heartbeat server from 6.3.2 to 6.83 . I have done upgradation to utilize the automatic monitor reload .it was working fine when 6.3.2 was runn… --- ## [Caused by: java.lang.NullPointerException: Cannot invoke \\"org.elasticsearch.index.analysis.AnalyzerComponents.getCharFilters()\\" because \\"components\\" is null](https://discuss.elastic.co/t/caused-by-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-index-analysis-analyzercomponents-getcharfilters-because-components-is-null/251824)
**Author:** [@jdoucy](https://discuss.elastic.co/u/jdoucy)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 12:25pm UTC](https://discuss.elastic.co/t/caused-by-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-index-analysis-analyzercomponents-getcharfilters-because-components-is-null/251824 "2020-10-14T12:25:05Z")
Hi there, I get an issue with \_reload\_search\_analyzers I simply try to reload a synonym file but it doesn't reload it, no error, just the new file is not taken into account. So I tried the old way, closing and re-open… --- ## [When \_index\_template is set \_template is ignored](https://discuss.elastic.co/t/when-index-template-is-set-template-is-ignored/252036)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/when-index-template-is-set-template-is-ignored/252036 "2020-10-14T11:45:29Z")
I created default \_index\_template to add attribute to settings for hot nodes since I set this parameter all \_templates are ignored. There is some incompatibility between \_index\_template and \_template do I have to migr… --- ## [Controls visualization filter uses the default index pattern](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/251189)
**Author:** [@lorehek](https://discuss.elastic.co/u/lorehek)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 11:41am UTC](https://discuss.elastic.co/t/controls-visualization-filter-uses-the-default-index-pattern/251189 "2020-10-14T11:41:35Z")
Hello community! I hope someone can help. I'd like to have the Controls visualization filter for particular value. I can do this in other visualizations such as the data table but since when creating the controls visua… --- ## [Doubt shard allocation balance between nodes](https://discuss.elastic.co/t/doubt-shard-allocation-balance-between-nodes/249638)
**Author:** [@adrian-arapiles](https://discuss.elastic.co/u/adrian-arapiles)\ **Replies:** 11\ **Last updated:** [October 14, 2020, 11:26am UTC](https://discuss.elastic.co/t/doubt-shard-allocation-balance-between-nodes/249638 "2020-10-14T11:26:12Z")
Hi, I have a doubt about shard node allocation in elasticsearch. Maybe I missed any page of documentation, but I didn't find a solution for my issue. I have a elasticsearch cluster with n number of nodes, and I have sp… --- ## [Add field based on another](https://discuss.elastic.co/t/add-field-based-on-another/250511)
**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Replies:** 9\ **Last updated:** [October 14, 2020, 11:24am UTC](https://discuss.elastic.co/t/add-field-based-on-another/250511 "2020-10-14T11:24:07Z")
Hello. I'd like to know if there's any possibility to add new field based on request filed, but with some regex. (%{NOTSPACE:request}\[?#$\]\\S\*) i'd like to add this one as field "request\_file" and the full output to st… --- ## [Visitor user agent information](https://discuss.elastic.co/t/visitor-user-agent-information/250515)
**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 11:23am UTC](https://discuss.elastic.co/t/visitor-user-agent-information/250515 "2020-10-14T11:23:32Z")
Hello! I am trying to separate in fields the useragent information, i've followed instructions from user-agent-processor Everything looks good, but when i check in kibana frontend, everything is still on same line, no… --- ## [Logstash grokparsefailure](https://discuss.elastic.co/t/logstash-grokparsefailure/250598)
**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 11:22am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/250598 "2020-10-14T11:22:53Z")
Hello! Is it there any way (human readable) to debug what is causing grokparsefailure? There's my nginx filter conf filter { if "nginx\_access" in \[tags\] { grok { patterns\_dir =\> \["/etc/logstash/patterns"\] ma… --- ## [Metricbeat for IBM MQ for remote queue manager](https://discuss.elastic.co/t/metricbeat-for-ibm-mq-for-remote-queue-manager/251423)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 11:02am UTC](https://discuss.elastic.co/t/metricbeat-for-ibm-mq-for-remote-queue-manager/251423 "2020-10-14T11:02:28Z")
Hi All, I am trying to use metricbeat for IBM MQ but I am Dashboard are blank and getting below message. Looks like, metricbeat isn't able to connect with my Queue manager No data to display for the selected metrics C… --- ## [String field to "mailto:" link](https://discuss.elastic.co/t/string-field-to-mailto-link/251995)
**Author:** [@sherifeldeeb](https://discuss.elastic.co/u/sherifeldeeb)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 10:59am UTC](https://discuss.elastic.co/t/string-field-to-mailto-link/251995 "2020-10-14T10:59:54Z")
I am trying to make a clickable "mailto:" out of a string field in kibana. For example: field contains "test@example.com", then the field will be displayed as a link that opens the default email client (e.g. \ **Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 10:53am UTC](https://discuss.elastic.co/t/metricbeat-system-dashboard/251200 "2020-10-14T10:53:41Z") Hi all, Recently when I'm exploring metricbeat I realised that there is some custom dashboard available in json format when we installed metricbeat. However, I'm not able to load the dashboard to kibana directly as ment… --- ## [Elasticsearch won't start after 7.9.1 to 7.9.2 upgrade](https://discuss.elastic.co/t/elasticsearch-wont-start-after-7-9-1-to-7-9-2-upgrade/249878)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-after-7-9-1-to-7-9-2-upgrade/249878 "2020-10-14T10:53:06Z")
For some reason, I am getting the following JVM error when starting elasticsearch 7.9.2 on CentOS7 after a yum upgrade. Any ideas? Thanks for any help: Exception in thread "main" java.lang.RuntimeException: starting ja… --- ## [Get visualization of missing data](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285)
**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 10:48am UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285 "2020-10-14T10:48:08Z")
I have data that comes in from many different sources(syslog hosts, ossec, etc). I need to visualize in a data table any sources that have been recieved in the last month but have NOT been recieved in the last 48 hours(T… --- ## [Effective strategy to recover from failed upgrade](https://discuss.elastic.co/t/effective-strategy-to-recover-from-failed-upgrade/252021)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 10:43am UTC](https://discuss.elastic.co/t/effective-strategy-to-recover-from-failed-upgrade/252021 "2020-10-14T10:43:42Z")
For a large Elasticsearch cluster that serve frequent index creation requests(lets say 1-2 per sec) and where it is not possible to pause these index creation during the rolling upgrade, what is the most effective strate… --- ## [Getting error in kibana \[Circuit breaking exception\]](https://discuss.elastic.co/t/getting-error-in-kibana-circuit-breaking-exception/252012)
**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 10:41am UTC](https://discuss.elastic.co/t/getting-error-in-kibana-circuit-breaking-exception/252012 "2020-10-14T10:41:08Z")
{ statusCode: 429, error: "Too Many Requests", message: "\[circuit\_breaking\_exception\] \[parent\] Data too large, data for \[\\] would be \[2047736072/1.9gb\], which is larger than the limit of \[2040109465/1.8gb\], … --- ## [Elastic search match query over array object](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786)
**Author:** [@aninda\_halder](https://discuss.elastic.co/u/aninda_halder)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 10:23am UTC](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786 "2020-10-14T10:23:53Z")
Suppose i've 3 doc doc\_1 = { "citedIn": \[ "Bar Councils Act, 1926 - Section 15", "Contract Act, 1872 - Section 23" \] } doc\_2 = { "citedIn":\[ "15 C. B 400", "Contract Act, 18… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1193) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1195)